Resguardo inicial

This commit is contained in:
lastdragon
2026-09-06 12:53:21 -06:00
parent 662efe3c2a
commit ad2088d178
94853 changed files with 43200404 additions and 0 deletions
@@ -0,0 +1,9 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe dynamic event - adding and removing
# requires: kprobe_events
echo p:myevent $FUNCTION_FORK > kprobe_events
grep myevent kprobe_events
test -d events/kprobes/myevent
echo > kprobe_events
@@ -0,0 +1,11 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe dynamic event - busy event check
# requires: kprobe_events
echo p:myevent $FUNCTION_FORK > kprobe_events
test -d events/kprobes/myevent
echo 1 > events/kprobes/myevent/enable
echo > kprobe_events && exit_fail # this must fail
echo 0 > events/kprobes/myevent/enable
echo > kprobe_events # this must succeed
@@ -0,0 +1,19 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe dynamic event with arguments
# requires: kprobe_events
echo "p:testprobe $FUNCTION_FORK \$stack \$stack0 +0(\$stack)" > kprobe_events
grep testprobe kprobe_events | grep -q 'arg1=\$stack arg2=\$stack0 arg3=+0(\$stack)'
test -d events/kprobes/testprobe
echo 1 > events/kprobes/testprobe/enable
( echo "forked")
grep testprobe trace | grep "$FUNCTION_FORK" | \
grep -q 'arg1=0x[[:xdigit:]]* arg2=0x[[:xdigit:]]* arg3=0x[[:xdigit:]]*$'
echo 0 > events/kprobes/testprobe/enable
echo "-:testprobe" >> kprobe_events
clear_trace
test -d events/kprobes/testprobe && exit_fail || exit_pass
@@ -0,0 +1,60 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe event char type argument
# requires: kprobe_events available_filter_functions
case `uname -m` in
x86_64)
ARG1=%di
;;
i[3456]86)
ARG1=%ax
;;
aarch64)
ARG1=%x0
;;
arm*)
ARG1=%r0
;;
ppc64*)
ARG1=%r3
;;
ppc*)
ARG1=%r3
;;
s390*)
ARG1=%r2
;;
mips*)
ARG1=%r4
;;
loongarch*)
ARG1=%r4
;;
riscv*)
ARG1=%a0
;;
*)
echo "Please implement other architecture here"
exit_untested
esac
: "Test get argument (1)"
if grep -q eventfs_create_dir available_filter_functions; then
DIR_NAME="eventfs_create_dir"
elif grep -q eventfs_add_dir available_filter_functions; then
DIR_NAME="eventfs_add_dir"
else
DIR_NAME="tracefs_create_dir"
fi
echo "p:testprobe ${DIR_NAME} arg1=+0(${ARG1}):char" > kprobe_events
echo 1 > events/kprobes/testprobe/enable
echo "p:test $FUNCTION_FORK" >> kprobe_events
grep -qe "testprobe.* arg1='t'" trace
echo 0 > events/kprobes/testprobe/enable
: "Test get argument (2)"
echo "p:testprobe ${DIR_NAME} arg1=+0(${ARG1}):char arg2=+0(${ARG1}):char[4]" > kprobe_events
echo 1 > events/kprobes/testprobe/enable
echo "p:test $FUNCTION_FORK" >> kprobe_events
grep -qe "testprobe.* arg1='t' arg2={'t','e','s','t'}" trace
@@ -0,0 +1,16 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe event with comm arguments
# requires: kprobe_events
grep -A1 "fetcharg:" README | grep -q "\$comm" || exit_unsupported # this is too old
echo "p:testprobe $FUNCTION_FORK comm=\$comm " > kprobe_events
grep testprobe kprobe_events | grep -q 'comm=$comm'
test -d events/kprobes/testprobe
echo 1 > events/kprobes/testprobe/enable
( echo "forked")
grep testprobe trace | grep -q 'comm=".*"'
exit 0
@@ -0,0 +1,61 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe event string type argument
# requires: kprobe_events available_filter_functions
case `uname -m` in
x86_64)
ARG1=%di
;;
i[3456]86)
ARG1=%ax
;;
aarch64)
ARG1=%x0
;;
arm*)
ARG1=%r0
;;
ppc64*)
ARG1=%r3
;;
ppc*)
ARG1=%r3
;;
s390*)
ARG1=%r2
;;
mips*)
ARG1=%r4
;;
loongarch*)
ARG1=%r4
;;
riscv*)
ARG1=%a0
;;
*)
echo "Please implement other architecture here"
exit_untested
esac
: "Test get argument (1)"
if grep -q eventfs_create_dir available_filter_functions; then
DIR_NAME="eventfs_create_dir"
elif grep -q eventfs_add_dir available_filter_functions; then
DIR_NAME="eventfs_add_dir"
else
DIR_NAME="tracefs_create_dir"
fi
echo "p:testprobe ${DIR_NAME} arg1=+0(${ARG1}):string" > kprobe_events
echo 1 > events/kprobes/testprobe/enable
echo "p:test $FUNCTION_FORK" >> kprobe_events
grep -qe "testprobe.* arg1=\"test\"" trace
echo 0 > events/kprobes/testprobe/enable
: "Test get argument (2)"
echo "p:testprobe ${DIR_NAME} arg1=+0(${ARG1}):string arg2=+0(${ARG1}):string" > kprobe_events
echo 1 > events/kprobes/testprobe/enable
echo "p:test $FUNCTION_FORK" >> kprobe_events
grep -qe "testprobe.* arg1=\"test\" arg2=\"test\"" trace
@@ -0,0 +1,38 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe event symbol argument
# requires: kprobe_events
SYMBOL="linux_proc_banner"
if [ ! -f /proc/kallsyms ]; then
echo "Can not check the target symbol - please enable CONFIG_KALLSYMS"
exit_unresolved
elif ! grep "$SYMBOL\$" /proc/kallsyms; then
echo "Linux banner is not exported - please enable CONFIG_KALLSYMS_ALL"
exit_unresolved
fi
: "Test get basic types symbol argument"
echo "p:testprobe_u $FUNCTION_FORK arg1=@linux_proc_banner:u64 arg2=@linux_proc_banner:u32 arg3=@linux_proc_banner:u16 arg4=@linux_proc_banner:u8" > kprobe_events
echo "p:testprobe_s $FUNCTION_FORK arg1=@linux_proc_banner:s64 arg2=@linux_proc_banner:s32 arg3=@linux_proc_banner:s16 arg4=@linux_proc_banner:s8" >> kprobe_events
if grep -q "x8/16/32/64" README; then
echo "p:testprobe_x $FUNCTION_FORK arg1=@linux_proc_banner:x64 arg2=@linux_proc_banner:x32 arg3=@linux_proc_banner:x16 arg4=@linux_proc_banner:x8" >> kprobe_events
fi
echo "p:testprobe_bf $FUNCTION_FORK arg1=@linux_proc_banner:b8@4/32" >> kprobe_events
echo 1 > events/kprobes/enable
(echo "forked")
echo 0 > events/kprobes/enable
grep "testprobe_[usx]:.* arg1=.* arg2=.* arg3=.* arg4=.*" trace
grep "testprobe_bf:.* arg1=.*" trace
: "Test get string symbol argument"
echo "p:testprobe_str $FUNCTION_FORK arg1=@linux_proc_banner:string" > kprobe_events
echo 1 > events/kprobes/enable
(echo "forked")
echo 0 > events/kprobes/enable
RESULT=`grep "testprobe_str" trace | sed -e 's/.* arg1=\(.*\)/\1/'`
RESULT=`echo $RESULT | sed -e 's/.* \((.*)\) \((.*)\) .*/\1 \2/'`
ORIG=`cat /proc/version | sed -e 's/.* \((.*)\) \((.*)\) .*/\1 \2/'`
test "$RESULT" = "$ORIG"
@@ -0,0 +1,115 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe event argument syntax
# requires: kprobe_events "x8/16/32/64":README
PROBEFUNC="vfs_read"
GOODREG=
BADREG=
GOODSYM="_sdata"
if ! grep -qw ${GOODSYM} /proc/kallsyms ; then
GOODSYM=$PROBEFUNC
fi
BADSYM="deaqswdefr"
SYMADDR=0x`grep -w ${GOODSYM} /proc/kallsyms | cut -f 1 -d " "`
GOODTYPE="x16"
BADTYPE="y16"
case `uname -m` in
x86_64|i[3456]86)
GOODREG=%ax
BADREG=%ex
;;
aarch64)
GOODREG=%x0
BADREG=%ax
;;
arm*)
GOODREG=%r0
BADREG=%ax
;;
ppc*)
GOODREG=%r3
BADREG=%msr
;;
s390*)
GOODREG=%r2
BADREG=%s2
;;
mips*)
GOODREG=%r4
BADREG=%r12
;;
loongarch*)
GOODREG=%r4
BADREG=%r12
;;
riscv*)
GOODREG=%a0
BADREG=%a8
;;
*)
echo "Please implement other architecture here"
exit_untested
esac
test_goodarg() # Good-args
{
while [ "$1" ]; do
echo "p ${PROBEFUNC} $1" > kprobe_events
shift 1
done;
}
test_badarg() # Bad-args
{
while [ "$1" ]; do
! echo "p ${PROBEFUNC} $1" > kprobe_events
shift 1
done;
}
echo > kprobe_events
: "Register access"
test_goodarg ${GOODREG}
test_badarg ${BADREG}
: "Symbol access"
test_goodarg "@${GOODSYM}" "@${SYMADDR}" "@${GOODSYM}+10" "@${GOODSYM}-10"
test_badarg "@" "@${BADSYM}" "@${GOODSYM}*10" "@${GOODSYM}/10" \
"@${GOODSYM}%10" "@${GOODSYM}&10" "@${GOODSYM}|10"
: "Stack access"
test_goodarg "\$stack" "\$stack0" "\$stack1"
test_badarg "\$stackp" "\$stack0+10" "\$stack1-10"
: "Retval access"
echo "r ${PROBEFUNC} \$retval" > kprobe_events
! echo "p ${PROBEFUNC} \$retval" > kprobe_events
# $comm was introduced in 4.8, older kernels reject it.
if grep -A1 "fetcharg:" README | grep -q '\$comm' ; then
: "Comm access"
test_goodarg "\$comm"
fi
: "Indirect memory access"
test_goodarg "+0(${GOODREG})" "-0(${GOODREG})" "+10(\$stack)" \
"+0(\$stack1)" "+10(@${GOODSYM}-10)" "+0(+10(+20(\$stack)))"
test_badarg "+(${GOODREG})" "(${GOODREG}+10)" "-(${GOODREG})" "(${GOODREG})" \
"+10(\$comm)" "+0(${GOODREG})+10"
: "Name assignment"
test_goodarg "varname=${GOODREG}"
test_badarg "varname=varname2=${GOODREG}"
: "Type syntax"
test_goodarg "${GOODREG}:${GOODTYPE}"
test_badarg "${GOODREG}::${GOODTYPE}" "${GOODREG}:${BADTYPE}" \
"${GOODTYPE}:${GOODREG}"
: "Combination check"
test_goodarg "\$comm:string" "+0(\$stack):string"
test_badarg "\$comm:x64" "\$stack:string" "${GOODREG}:string"
@@ -0,0 +1,47 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobes event arguments with types
# requires: kprobe_events "x8/16/32/64":README
gen_event() { # Bitsize
echo "p:testprobe $FUNCTION_FORK \$stack0:s$1 \$stack0:u$1 \$stack0:x$1 \$stack0:b4@4/$1"
}
check_types() { # s-type u-type x-type bf-type width
test $# -eq 5
CW=$5
CW=$((CW / 4))
X1=`printf "%x" $1 | tail -c ${CW}`
X2=`printf "%x" $2`
X3=`printf "%x" $3`
test $X1 = $X2
test $X2 = $X3
test 0x$X3 = $3
B4=`printf "%1x" $4`
B3=`printf "%03x" 0x$X3 | tail -c 2 | head -c 1`
test $B3 = $B4
}
for width in 64 32 16 8; do
: "Add new event with basic types"
gen_event $width > kprobe_events
grep testprobe kprobe_events
test -d events/kprobes/testprobe
: "Trace the event"
echo 1 > events/kprobes/testprobe/enable
( echo "forked")
echo 0 > events/kprobes/testprobe/enable
: "Confirm the arguments is recorded in given types correctly"
ARGS=`grep "testprobe" trace | head -n 1 | sed -e 's/.* arg1=\(.*\) arg2=\(.*\) arg3=\(.*\) arg4=\(.*\)/\1 \2 \3 \4/'`
check_types $ARGS $width
: "Clear event for next loop"
echo "-:testprobe" >> kprobe_events
clear_trace
done
exit_pass
@@ -0,0 +1,34 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe event user-memory access
# requires: kprobe_events '$arg<N>':README
grep -A10 "fetcharg:" README | grep -q 'ustring' || exit_unsupported
grep -A10 "fetcharg:" README | grep -q '\[u\]<offset>' || exit_unsupported
:;: "user-memory access syntax and ustring working on user memory";:
echo 'p:myevent do_sys_open path=+0($arg2):ustring path2=+u0($arg2):string' \
> kprobe_events
echo 'p:myevent2 do_sys_openat2 path=+0($arg2):ustring path2=+u0($arg2):string' \
>> kprobe_events
grep myevent kprobe_events | \
grep -q 'path=+0($arg2):ustring path2=+u0($arg2):string'
echo 1 > events/kprobes/myevent/enable
echo 1 > events/kprobes/myevent2/enable
echo > /dev/null
echo 0 > events/kprobes/myevent/enable
echo 0 > events/kprobes/myevent2/enable
grep myevent trace | grep -q 'path="/dev/null" path2="/dev/null"'
:;: "user-memory access syntax and ustring not working with kernel memory";:
echo 'p:myevent vfs_symlink path=+0($arg3):ustring path2=+u0($arg3):string' \
> kprobe_events
echo 1 > events/kprobes/myevent/enable
ln -s foo $TMPDIR/bar
echo 0 > events/kprobes/myevent/enable
grep myevent trace | grep -q 'path=(fault) path2=(fault)'
exit 0
@@ -0,0 +1,40 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe event VFS type argument
# requires: kprobe_events "%pd/%pD":README
: "Test argument %pd with name"
echo 'p:testprobe dput name=$arg1:%pd' > kprobe_events
echo 1 > events/kprobes/testprobe/enable
grep -q "1" events/kprobes/testprobe/enable
echo 0 > events/kprobes/testprobe/enable
grep "dput" trace | grep -q "enable"
echo "" > kprobe_events
echo "" > trace
: "Test argument %pd without name"
echo 'p:testprobe dput $arg1:%pd' > kprobe_events
echo 1 > events/kprobes/testprobe/enable
grep -q "1" events/kprobes/testprobe/enable
echo 0 > events/kprobes/testprobe/enable
grep "dput" trace | grep -q "enable"
echo "" > kprobe_events
echo "" > trace
: "Test argument %pD with name"
echo 'p:testprobe vfs_read name=$arg1:%pD' > kprobe_events
echo 1 > events/kprobes/testprobe/enable
grep -q "1" events/kprobes/testprobe/enable
echo 0 > events/kprobes/testprobe/enable
grep "vfs_read" trace | grep -q "enable"
echo "" > kprobe_events
echo "" > trace
: "Test argument %pD without name"
echo 'p:testprobe vfs_read $arg1:%pD' > kprobe_events
echo 1 > events/kprobes/testprobe/enable
grep -q "1" events/kprobes/testprobe/enable
echo 0 > events/kprobes/testprobe/enable
grep "vfs_read" trace | grep -q "enable"
echo "" > kprobe_events
echo "" > trace
@@ -0,0 +1,46 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe event auto/manual naming
# requires: kprobe_events
:;: "Add an event on function without name" ;:
FUNC=`grep " [tT] .*vfs_read$" /proc/kallsyms | tail -n 1 | cut -f 3 -d " "`
[ "x" != "x$FUNC" ] || exit_unresolved
echo "p $FUNC" > kprobe_events
PROBE_NAME=`echo $FUNC | tr ".:" "_"`
test -d events/kprobes/p_${PROBE_NAME}_0 || exit_failure
:;: "Add an event on function with new name" ;:
echo "p:event1 $FUNC" > kprobe_events
test -d events/kprobes/event1 || exit_failure
:;: "Add an event on function with new name and group" ;:
echo "p:kprobes2/event2 $FUNC" > kprobe_events
test -d events/kprobes2/event2 || exit_failure
:;: "Add an event on dot function without name" ;:
find_dot_func() {
if [ ! -f available_filter_functions ]; then
grep -m 10 " [tT] .*\.isra\..*$" /proc/kallsyms | tail -n 1 | cut -f 3 -d " "
return;
fi
grep " [tT] .*\.isra\..*" /proc/kallsyms | cut -f 3 -d " " | while read f; do
cnt=`grep -s $f available_filter_functions | wc -l`;
if [ $cnt -eq 1 ]; then
echo $f
break
fi
done
}
FUNC=`find_dot_func | tail -n 1`
[ "x" != "x$FUNC" ] || exit_unresolved
echo "p $FUNC" > kprobe_events
EVENT=`grep $FUNC kprobe_events | cut -f 1 -d " " | cut -f 2 -d:`
[ "x" != "x$EVENT" ] || exit_failure
test -d events/$EVENT || exit_failure
@@ -0,0 +1,45 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe dynamic event with function tracer
# requires: kprobe_events stack_trace_filter function:tracer
# prepare
echo nop > current_tracer
echo $FUNCTION_FORK > set_ftrace_filter
echo "p:testprobe $FUNCTION_FORK" > kprobe_events
# kprobe on / ftrace off
echo 1 > events/kprobes/testprobe/enable
echo > trace
( echo "forked")
grep testprobe trace
! grep "$FUNCTION_FORK <-" trace
# kprobe on / ftrace on
echo function > current_tracer
echo > trace
( echo "forked")
grep testprobe trace
grep "$FUNCTION_FORK <-" trace
# kprobe off / ftrace on
echo 0 > events/kprobes/testprobe/enable
echo > trace
( echo "forked")
! grep testprobe trace
grep "$FUNCTION_FORK <-" trace
# kprobe on / ftrace on
echo 1 > events/kprobes/testprobe/enable
echo function > current_tracer
echo > trace
( echo "forked")
grep testprobe trace
grep "$FUNCTION_FORK <-" trace
# kprobe on / ftrace off
echo nop > current_tracer
echo > trace
( echo "forked")
grep testprobe trace
! grep "$FUNCTION_FORK <-" trace
@@ -0,0 +1,19 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0-or-later
# Copyright (C) 2023 Akanksha J N, IBM corporation
# description: Register multiple kprobe events in a function
# requires: kprobe_events
for i in `seq 0 255`; do
echo p $FUNCTION_FORK+${i} >> kprobe_events || continue
done
cat kprobe_events >> $testlog
echo 1 > events/kprobes/enable
( echo "forked" )
echo 0 > events/kprobes/enable
echo > kprobe_events
echo "Waiting for unoptimizing & freeing"
sleep 5
echo "Done"
@@ -0,0 +1,52 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe dynamic event - probing module
# requires: kprobe_events
rmmod trace-printk ||:
if ! modprobe trace-printk ; then
echo "No trace-printk sample module - please make CONFIG_SAMPLE_TRACE_PRINTK=
m"
exit_unresolved;
fi
MOD=trace_printk
FUNC=trace_printk_irq_work
:;: "Add an event on a module function without specifying event name" ;:
echo "p $MOD:$FUNC" > kprobe_events
PROBE_NAME=`echo $MOD:$FUNC | tr ".:" "_"`
test -d events/kprobes/p_${PROBE_NAME}_0 || exit_failure
:;: "Add an event on a module function with new event name" ;:
echo "p:event1 $MOD:$FUNC" > kprobe_events
test -d events/kprobes/event1 || exit_failure
:;: "Add an event on a module function with new event and group name" ;:
echo "p:kprobes1/event1 $MOD:$FUNC" > kprobe_events
test -d events/kprobes1/event1 || exit_failure
:;: "Remove target module, but event still be there" ;:
if ! rmmod trace-printk ; then
echo "Failed to unload module - please enable CONFIG_MODULE_UNLOAD"
exit_unresolved;
fi
test -d events/kprobes1/event1
:;: "Check posibility to defining events on unloaded module";:
echo "p:event2 $MOD:$FUNC" >> kprobe_events
:;: "Target is gone, but we can prepare for next time";:
echo 1 > events/kprobes1/event1/enable
:;: "Load module again, which means the event1 should be recorded";:
modprobe trace-printk
grep "event1:" trace
:;: "Remove the module again and check the event is not locked"
rmmod trace-printk
echo 0 > events/kprobes1/event1/enable
echo "-:kprobes1/event1" >> kprobe_events
@@ -0,0 +1,32 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Create/delete multiprobe on kprobe event
# requires: kprobe_events "Create/append/":README
# Choose 2 symbols for target
SYM1=$FUNCTION_FORK
SYM2=do_exit
EVENT_NAME=kprobes/testevent
DEF1="p:$EVENT_NAME $SYM1"
DEF2="p:$EVENT_NAME $SYM2"
:;: "Define an event which has 2 probes" ;:
echo $DEF1 >> kprobe_events
echo $DEF2 >> kprobe_events
cat kprobe_events | grep "$DEF1"
cat kprobe_events | grep "$DEF2"
:;: "Remove the event by name (should remove both)" ;:
echo "-:$EVENT_NAME" >> kprobe_events
test `cat kprobe_events | wc -l` -eq 0
:;: "Remove just 1 event" ;:
echo $DEF1 >> kprobe_events
echo $DEF2 >> kprobe_events
echo "-:$EVENT_NAME $SYM1" >> kprobe_events
! cat kprobe_events | grep "$DEF1"
cat kprobe_events | grep "$DEF2"
:;: "Appending different type must fail" ;:
! echo "$DEF1 \$stack" >> kprobe_events
@@ -0,0 +1,13 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Test failure of registering kprobe on non unique symbol
# requires: kprobe_events
SYMBOL='name_show'
# We skip this test on kernel where SYMBOL is unique or does not exist.
if [ "$(grep -c -E "[[:alnum:]]+ t ${SYMBOL}" /proc/kallsyms)" -le '1' ]; then
exit_unsupported
fi
! echo "p:test_non_unique ${SYMBOL}" > kprobe_events
@@ -0,0 +1,34 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0-or-later
# Copyright (C) 2023 Akanksha J N, IBM corporation
# description: Register/unregister optimized probe
# requires: kprobe_events
case `uname -m` in
x86_64)
;;
arm*)
;;
ppc*)
;;
*)
echo "Please implement other architecture here"
exit_unsupported
esac
DEFAULT=$(cat /proc/sys/debug/kprobes-optimization)
echo 1 > /proc/sys/debug/kprobes-optimization
for i in `seq 0 255`; do
echo "p:testprobe $FUNCTION_FORK+${i}" > kprobe_events || continue
echo 1 > events/kprobes/enable || continue
(echo "forked")
PROBE=$(grep $FUNCTION_FORK /sys/kernel/debug/kprobes/list)
echo 0 > events/kprobes/enable
echo > kprobe_events
if echo $PROBE | grep -q OPTIMIZED; then
echo "$DEFAULT" > /proc/sys/debug/kprobes-optimization
exit_pass
fi
done
echo "$DEFAULT" > /proc/sys/debug/kprobes-optimization
exit_unresolved
@@ -0,0 +1,122 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe event parser error log check
# requires: kprobe_events error_log
check_error() { # command-with-error-pos-by-^
ftrace_errlog_check 'trace_kprobe' "$1" 'kprobe_events'
}
if grep -q 'r\[maxactive\]' README; then
check_error 'p^100 vfs_read' # BAD_MAXACT_TYPE
check_error 'r^1a111 vfs_read' # BAD_MAXACT
check_error 'r^100000 vfs_read' # MAXACT_TOO_BIG
fi
check_error 'p ^non_exist_func' # BAD_PROBE_ADDR (enoent)
check_error 'p ^hoge-fuga' # BAD_PROBE_ADDR (bad syntax)
check_error 'p ^hoge+1000-1000' # BAD_PROBE_ADDR (bad syntax)
check_error 'r ^vfs_read+10' # BAD_RETPROBE
check_error 'p:^/bar vfs_read' # NO_GROUP_NAME
check_error 'p:^12345678901234567890123456789012345678901234567890123456789012345/bar vfs_read' # GROUP_TOO_LONG
check_error 'p:^foo.1/bar vfs_read' # BAD_GROUP_NAME
check_error 'p:^ vfs_read' # NO_EVENT_NAME
check_error 'p:foo/^12345678901234567890123456789012345678901234567890123456789012345 vfs_read' # EVENT_TOO_LONG
check_error 'p:foo/^bar.1 vfs_read' # BAD_EVENT_NAME
check_error 'p vfs_read ^$retval' # RETVAL_ON_PROBE
check_error 'p vfs_read ^$stack10000' # BAD_STACK_NUM
if grep -q '$arg<N>' README; then
check_error 'p vfs_read ^$arg10000' # BAD_ARG_NUM
fi
check_error 'p vfs_read ^$none_var' # BAD_VAR
check_error 'p vfs_read ^%none_reg' # BAD_REG_NAME
check_error 'p vfs_read ^@12345678abcde' # BAD_MEM_ADDR
check_error 'p vfs_read ^@+10' # FILE_ON_KPROBE
grep -q "imm-value" README && \
check_error 'p vfs_read arg1=\^x' # BAD_IMM
grep -q "imm-string" README && \
check_error 'p vfs_read arg1=\"abcd^' # IMMSTR_NO_CLOSE
check_error 'p vfs_read ^+0@0)' # DEREF_NEED_BRACE
check_error 'p vfs_read ^+0ab1(@0)' # BAD_DEREF_OFFS
check_error 'p vfs_read +0(+0(@0^)' # DEREF_OPEN_BRACE
if grep -A1 "fetcharg:" README | grep -q '\$comm' ; then
check_error 'p vfs_read +0(^$comm)' # COMM_CANT_DEREF
fi
check_error 'p vfs_read ^&1' # BAD_FETCH_ARG
# We've introduced this limitation with array support
if grep -q ' <type>\\\[<array-size>\\\]' README; then
check_error 'p vfs_read +0(^+0(+0(+0(+0(+0(+0(+0(+0(+0(+0(+0(+0(+0(@0))))))))))))))' # TOO_MANY_OPS?
check_error 'p vfs_read +0(@11):u8[10^' # ARRAY_NO_CLOSE
check_error 'p vfs_read +0(@11):u8[10]^a' # BAD_ARRAY_SUFFIX
check_error 'p vfs_read +0(@11):u8[^10a]' # BAD_ARRAY_NUM
check_error 'p vfs_read +0(@11):u8[^256]' # ARRAY_TOO_BIG
fi
check_error 'p vfs_read @11:^unknown_type' # BAD_TYPE
check_error 'p vfs_read $stack0:^string' # BAD_STRING
check_error 'p vfs_read @11:^b10@a/16' # BAD_BITFIELD
check_error 'p vfs_read ^arg123456789012345678901234567890=@11' # ARG_NAME_TOO_LOG
check_error 'p vfs_read ^=@11' # NO_ARG_NAME
check_error 'p vfs_read ^var.1=@11' # BAD_ARG_NAME
check_error 'p vfs_read var1=@11 ^var1=@12' # USED_ARG_NAME
check_error 'p vfs_read ^+1234567(+1234567(+1234567(+1234567(+1234567(+1234567(@1234))))))' # ARG_TOO_LONG
check_error 'p vfs_read arg1=^' # NO_ARG_BODY
# instruction boundary check is valid on x86 (at this moment)
case $(uname -m) in
x86_64|i[3456]86)
echo 'p vfs_read' > kprobe_events
if grep -q FTRACE ../kprobes/list ; then
check_error 'p ^vfs_read+3' # BAD_INSN_BNDRY (only if function-tracer is enabled)
fi
;;
esac
# multiprobe errors
if grep -q "Create/append/" README && grep -q "imm-value" README; then
echo "p:kprobes/testevent $FUNCTION_FORK" > kprobe_events
check_error '^r:kprobes/testevent do_exit' # DIFF_PROBE_TYPE
# Explicitly use printf "%s" to not interpret \1
printf "%s" "p:kprobes/testevent $FUNCTION_FORK abcd=\\1" > kprobe_events
check_error "p:kprobes/testevent $FUNCTION_FORK ^bcd=\\1" # DIFF_ARG_TYPE
check_error "p:kprobes/testevent $FUNCTION_FORK ^abcd=\\1:u8" # DIFF_ARG_TYPE
check_error "p:kprobes/testevent $FUNCTION_FORK ^abcd=\\\"foo\"" # DIFF_ARG_TYPE
check_error "^p:kprobes/testevent $FUNCTION_FORK abcd=\\1" # SAME_PROBE
fi
# %return suffix errors
if grep -q "place (kretprobe): .*%return.*" README; then
check_error 'p vfs_read^%hoge' # BAD_ADDR_SUFFIX
check_error 'p ^vfs_read+10%return' # BAD_RETPROBE
fi
# BTF arguments errors
if grep -q "<argname>" README; then
check_error 'p vfs_read args=^$arg*' # BAD_VAR_ARGS
check_error 'p vfs_read +0(^$arg*)' # BAD_VAR_ARGS
check_error 'p vfs_read $arg* ^$arg*' # DOUBLE_ARGS
if !grep -q 'kernel return probes support:' README; then
check_error 'r vfs_read ^$arg*' # NOFENTRY_ARGS
fi
check_error 'p vfs_read+20 ^$arg*' # NOFENTRY_ARGS
check_error 'p vfs_read ^hoge' # NO_BTFARG
check_error 'p kfree ^$arg10' # NO_BTFARG (exceed the number of parameters)
check_error 'r kfree ^$retval' # NO_RETVAL
else
check_error 'p vfs_read ^$arg*' # NOSUP_BTFARG
fi
exit 0
@@ -0,0 +1,19 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kretprobe dynamic event with arguments
# requires: kprobe_events
# Add new kretprobe event
echo "r:testprobe2 $FUNCTION_FORK \$retval" > kprobe_events
grep testprobe2 kprobe_events | grep -q 'arg1=\$retval'
test -d events/kprobes/testprobe2
echo 1 > events/kprobes/testprobe2/enable
( echo "forked")
cat trace | grep testprobe2 | grep -q "<- $FUNCTION_FORK"
echo 0 > events/kprobes/testprobe2/enable
echo '-:testprobe2' >> kprobe_events
clear_trace
test -d events/kprobes/testprobe2 && exit_fail || exit_pass
@@ -0,0 +1,18 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kretprobe entry argument access
# requires: kprobe_events 'kernel return probes support:':README
echo 'p:myevent1 vfs_open arg=$arg1' >> kprobe_events
echo 'r:myevent2 vfs_open arg=$arg1' >> kprobe_events
echo 1 > events/kprobes/enable
echo > trace
cat trace > /dev/null
streq() {
test $1 = $2
}
streq `grep -A 1 -m 1 myevent1 trace | sed -r 's/^.*(arg=.*)/\1/' `
@@ -0,0 +1,35 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kretprobe dynamic event with maxactive
# requires: kprobe_events 'r[maxactive]':README
# Test if we successfully reject unknown messages
if echo 'a:myprobeaccept inet_csk_accept' > kprobe_events; then false; else true; fi
# Test if we successfully reject too big maxactive
if echo 'r1000000:myprobeaccept inet_csk_accept' > kprobe_events; then false; else true; fi
# Test if we successfully reject unparsable numbers for maxactive
if echo 'r10fuzz:myprobeaccept inet_csk_accept' > kprobe_events; then false; else true; fi
# Test for kretprobe with event name without maxactive
echo 'r:myprobeaccept inet_csk_accept' > kprobe_events
grep myprobeaccept kprobe_events
test -d events/kprobes/myprobeaccept
echo '-:myprobeaccept' >> kprobe_events
# Test for kretprobe with event name with a small maxactive
echo 'r10:myprobeaccept inet_csk_accept' > kprobe_events
grep myprobeaccept kprobe_events
test -d events/kprobes/myprobeaccept
echo '-:myprobeaccept' >> kprobe_events
# Test for kretprobe without event name without maxactive
echo 'r inet_csk_accept' > kprobe_events
grep inet_csk_accept kprobe_events
echo > kprobe_events
# Test for kretprobe without event name with a small maxactive
echo 'r10 inet_csk_accept' > kprobe_events
grep inet_csk_accept kprobe_events
echo > kprobe_events
@@ -0,0 +1,21 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kretprobe %%return suffix test
# requires: kprobe_events '<symbol>[+<offset>]%return':README
# Test for kretprobe by "r"
echo 'r:myprobeaccept vfs_read' > kprobe_events
RESULT1=`cat kprobe_events`
# Test for kretprobe by "%return"
echo 'p:myprobeaccept vfs_read%return' > kprobe_events
RESULT2=`cat kprobe_events`
if [ "$RESULT1" != "$RESULT2" ]; then
echo "Error: %return suffix didn't make a return probe."
echo "r-command: $RESULT1"
echo "%return: $RESULT2"
exit_fail
fi
echo > kprobe_events
@@ -0,0 +1,35 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Register/unregister many kprobe events
# requires: kprobe_events
# ftrace fentry skip size depends on the machine architecture.
# Currently HAVE_KPROBES_ON_FTRACE defined on x86 and powerpc64le
case `uname -m` in
x86_64|i[3456]86) OFFS=5;;
ppc64le) OFFS=8;;
*) OFFS=0;;
esac
N=0
echo "Setup up kprobes on first available 256 text symbols"
grep -i " t " /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \
while read i; do
echo p ${i}+${OFFS} >> kprobe_events && N=$((N+1)) ||:
test $N -eq 256 && break
done
L=`cat kprobe_events | wc -l`
if [ $L -ne 256 ]; then
echo "The number of kprobes events ($L) is not 256"
exit_fail
fi
cat kprobe_events >> $testlog
echo 1 > events/kprobes/enable
echo 0 > events/kprobes/enable
echo > kprobe_events
echo "Waiting for unoptimizing & freeing"
sleep 5
echo "Done"
@@ -0,0 +1,38 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe events - probe points
# requires: kprobe_events
TARGET_FUNC=tracefs_create_dir
dec_addr() { # hexaddr
printf "%d" "0x"`echo $1 | tail -c 8`
}
set_offs() { # prev target next
A1=`dec_addr $1`
A2=`dec_addr $2`
A3=`dec_addr $3`
TARGET="0x$2" # an address
PREV=`expr $A1 - $A2` # offset to previous symbol
NEXT=+`expr $A3 - $A2` # offset to next symbol
OVERFLOW=+`printf "0x%x" ${PREV}` # overflow offset to previous symbol
}
# We have to decode symbol addresses to get correct offsets.
# If the offset is not an instruction boundary, it cause -EILSEQ.
set_offs `grep -v __pfx_ /proc/kallsyms | grep -A1 -B1 ${TARGET_FUNC} | cut -f 1 -d " " | xargs`
UINT_TEST=no
# printf "%x" -1 returns (unsigned long)-1.
if [ `printf "%x" -1 | wc -c` != 9 ]; then
UINT_TEST=yes
fi
echo "p:testprobe ${TARGET_FUNC}" > kprobe_events
echo "p:testprobe ${TARGET}" > kprobe_events
echo "p:testprobe ${TARGET_FUNC}${NEXT}" > kprobe_events
! echo "p:testprobe ${TARGET_FUNC}${PREV}" > kprobe_events
if [ "${UINT_TEST}" = yes ]; then
! echo "p:testprobe ${TARGET_FUNC}${OVERFLOW}" > kprobe_events
fi
@@ -0,0 +1,14 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Kprobe profile
# requires: kprobe_events
! grep -q 'myevent' kprobe_profile
echo "p:myevent $FUNCTION_FORK" > kprobe_events
grep -q 'myevent[[:space:]]*0[[:space:]]*0$' kprobe_profile
echo 1 > events/kprobes/myevent/enable
( echo "forked" )
grep -q 'myevent[[:space:]]*[[:digit:]]*[[:space:]]*0$' kprobe_profile
echo 0 > events/kprobes/myevent/enable
echo > kprobe_events
! grep -q 'myevent' kprobe_profile
@@ -0,0 +1,31 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
# description: Uprobe event parser error log check
# requires: uprobe_events error_log
check_error() { # command-with-error-pos-by-^
ftrace_errlog_check 'trace_uprobe' "$1" 'uprobe_events'
}
check_error 'p ^/non_exist_file:100' # FILE_NOT_FOUND
check_error 'p ^/sys:100' # NO_REGULAR_FILE
check_error 'p /bin/sh:^10a' # BAD_UPROBE_OFFS
check_error 'p /bin/sh:10(^1a)' # BAD_REFCNT
check_error 'p /bin/sh:10(10^' # REFCNT_OPEN_BRACE
check_error 'p /bin/sh:10(10)^a' # BAD_REFCNT_SUFFIX
check_error 'p /bin/sh:10 ^@+ab' # BAD_FILE_OFFS
check_error 'p /bin/sh:10 ^@symbol' # SYM_ON_UPROBE
# %return suffix error
if grep -q "place (uprobe): .*%return.*" README; then
check_error 'p /bin/sh:10^%hoge' # BAD_ADDR_SUFFIX
check_error 'p /bin/sh:10(10)^%return' # BAD_REFCNT_SUFFIX
fi
# symstr is not supported by uprobe
if grep -q ".*symstr.*" README; then
check_error 'p /bin/sh:10 $stack0:^symstr' # BAD_TYPE
fi
exit 0